Mask Sets for Side-Channel Analysis Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting circuits and software against side channel analysis, such as SPA, DPA, CPA, and EMA, are inadequate as they do not effectively resist the disclosure of secret data, particularly encryption keys, due to vulnerabilities in current countermeasures.
Innovation Solution
A method involving the use of Exclusive OR (XOR) operations with mask sets and masked substitution tables is employed to protect cryptographic operations, ensuring that each data set includes all possible values with equal occurrences, thereby masking the secret key and resisting statistical analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional masking methods are used to protect cryptographic operations, then some protection against side channel analysis is provided, but the protection is inadequate and secret data can still be disclosed through statistical analysis
Solution Approach 1:
The secret data is segmented by combining it with multiple mask parameters (first mask parameter and second mask parameter) to create masked versions. The cryptographic operation is then performed on these segmented masked values rather than the original secret data, preventing direct observation of the secret through side channel analysis.
Solution Approach 2:
The invention changes the parameters of the cryptographic operation by introducing mask parameters that transform the original secret data into masked representations. These parameter changes ensure that the actual secret values never appear in their original form during computation, thereby eliminating the basis for statistical side channel attacks.
2Productivity
If statistical analysis methods are used to perform cryptographic operations, then processing efficiency is maintained, but vulnerability to side channel attacks increases due to observable consumption patterns
Solution Approach 1:
Mask parameters serve as intermediaries between the secret data and the cryptographic operation. The operation is performed on the intermediary masked values rather than the secret data directly. This intermediary layer prevents the observation of secret data through power consumption or electromagnetic emissions while maintaining the efficiency of statistical analysis methods.
3Ease of manufacture
If simple masking with single mask parameters is applied, then implementation is straightforward, but the masking can be broken through correlation power analysis
Solution Approach 1:
The single mask parameter is segmented into multiple independent mask parameters (first mask parameter and second mask parameter). These segmented masks are combined with the secret data in a specific manner that creates a more complex masking structure, making it resistant to correlation power analysis while maintaining reasonable implementation complexity.
Solution Approach 2:
The invention uses a composite masking approach where multiple mask parameters are combined together to form a composite mask structure. This composite masking provides enhanced security against CPA attacks compared to simple single-parameter masking, while the modular nature of the combination keeps the implementation manageable.
Data Source
Figure 1~2
Figure 3~6
Figure 7~8
AI summary
The invention relates to a method for executing by a circuit an operation (OPR) whereby a first input data (X1), is combined with a second input data (X2), the method comprising: defining data pairs whereby each data of a first input set (PX1) is associated with a respective data of a second input set (PX2), the data in the first and second input sets being obtained by applying Exclusive OR (XOR) operations (⊕) to the first and second input data and to all first and second mask parameters of first and second mask sets; and computing output data by applying the operation to each of the data pairs, to obtain an output set (PR1), the first and second mask sets being such that a combination by XOR operations of each pairs of corresponding first and second mask parameters produces a third mask set, each mask sets comprising a word column comprising a same number of occurrences of all possible values of the words.